36 lines
3.0 KiB
Markdown
36 lines
3.0 KiB
Markdown
# Data model completion audit — 2026-09-10
|
||
|
||
The `model` node previously described push persistence and account deletion as
|
||
unfinished. Those statements are obsolete. This audit compares its requirements
|
||
with the current SQL changelog, services and existing passing tests; it adds no
|
||
migration and changes no data.
|
||
|
||
| Requirement | Implemented evidence |
|
||
| --- | --- |
|
||
| Private accounts, email identity, invitations and revocable device logins | `app_user`, `email_identity`, `account_invitation`, `admission_control`, `device_login`; email/admission/device services use transactions and hashed proofs. |
|
||
| Work belongs to the owner's customer/project | Composite foreign keys in `work_project` and `work_entry`; `OwnerTransactions` locks the active owner while `WorkService` checks the daily total and record version. |
|
||
| Daily habits, historical bounds and days off | `habit`, `habit_day`, `habit_limit`, `day_off`, their unique keys and owner relations; HabitService handles Monday boundaries and hint-only limits. |
|
||
| Defaults applied once | `account_defaults` records per-owner initialization; catalog/preferences remain owner-bound. |
|
||
| Push subscriptions and retry state | A subscription references its device login; device/account validation and optimistic versions are enforced by PushSubscriptions. ReminderQueue persists per-subscription/date status, retries and leases. Device deletion cascades to subscriptions and deliveries. |
|
||
| Complete transactional account deletion | AccountDeletion consumes the fresh proof and deletes the private trail in one transaction. Spent invitation markers remain spent; deletion cascades cover identity, device, push and deletion-grant records. |
|
||
| Time and browser boundaries | Technical timestamps use UTC epoch seconds derived from Instant; business dates use SQL DATE/LocalDate and validated IANA ZoneId identifiers. Browser drafts are not stored in these server tables. |
|
||
|
||
Historical `oidc_identity` schema remains for compatibility with existing
|
||
database histories and is cleaned during account deletion. The active account
|
||
binding is `email_identity`; no external identity provider is needed.
|
||
|
||
Reviewed passing CI XML reports from the 2026-09-10 05:50–05:51 UTC run cover
|
||
AccountDeletion (5 tests), AccountDeletionProofs (7), DeviceLoginService (7),
|
||
WorkService (8), HabitService (12), CatalogService (6), and EmailAccounts (10),
|
||
all with zero failures/errors/skips. The existing local PushSubscriptions report
|
||
adds 15 passing tests including queue restart/retry and concurrent claim
|
||
behavior; AdmissionService adds three. The complete CI build for `13f6c25`
|
||
(0.1.86-SNAPSHOT) succeeded and deployed. The schema's last change was
|
||
`2833c48`, before these test runs.
|
||
|
||
H2 selection and jOOQ comparison remain documented in the persistence spike
|
||
and decision 0001. Real failed-migration rollback is covered by WJ-021, with
|
||
consecutive failures and failed recovery covered separately. These establish
|
||
the persistence implementation; physical Android/background push delivery and
|
||
restoration from Hostsharing's own backups remain open under their own nodes.
|